Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DissidentX – Censorship resistance tool by Bram Cohen

github.com

Post reply on HN
Print view View original

81–90 of 93 posts

Re: DissidentX – Censorship resistance tool by Bram Cohen

#81

Post by nl »

zzzeek wrote: post #69
sillysaurus2 wrote: post #59

Earlier quoted context omitted.

The README should read: Q. Can someone detect that a file has messages encoded in it? A. If the file was generated with an encoder whose code is public (i.e. Github, bitbucket, ...) then yes. Always. And even if the code is private, it may not be secure. Unless you come up with an encoding scheme that's never been thought of before, then law enforcement will likely be able to detect the encoded messages unless they'r…

random peanut gallery thought....mentioning "law enforcement" in the README itself might open up the tool itself to legal attacks, no ?

No

Re: DissidentX – Censorship resistance tool by Bram Cohen

#82

Post by cynicalkane »

sillysaurus2 wrote: post #54
skunkworks wrote: post #50

Earlier quoted context omitted.

There's great irony in you saying > Let's not get personal. right after saying > I'm surprised to see someone of Bram Cohen's caliber releasing something like this.

I feel bad about it. I shouldn't have called him out by name; I should've concentrated solely on why this tool falls short. Sorry, Bram. I'm just worried that people will see his name, see that he's saying things like "this tool is ready to be used," and then actually use this, just because "It's Bram Cohen," and end up getting themselves caught.

I don't see anything wrong with pointing out that a famous person's work is below par, particularly when said person decides to show up in the thread and ignore what you are saying and act like a jerk in response. You shouldn't retreat so easily.

Re: DissidentX – Censorship resistance tool by Bram Cohen

#83

Post by onetwofiveten »

dinkumthinkum wrote: post #75
phil_2-0 wrote: post #38

Earlier quoted context omitted.

> "Uncrackable encryption is allowing terrorists — Hamas, Hezbollah, al-Qaida and others — to communicate about their criminal intentions without fear of outside intrusion, You succeeded to put 3 different ethnic groups - I should say 2, the last one being an US product - in the same bag and doing then, a misleading association, fucking idiot!

:( Are you one of those people that doesn't like to call things what they are? I have noticed many problems in life are due to people know wanting to call things what they are.

Are you one of those people who thinks he knows an obvious truth that everyone else ignores for some reason?

Re: DissidentX – Censorship resistance tool by Bram Cohen

#84

Post by danbruc »

chongli wrote: post #29
MichaelGG wrote: post #17

Earlier quoted context omitted.

At some ratio of hidden data to visible data, I'm sure it can be undetectable. But transmitting reasonable amounts of data leaves a trace using LSB algorithms. Here's one paper. It shows the LSB part of the image, which leaves an obvious looking impression. http://rahuldotgarg.appspot.com/data/steg.pdf

This is just showing steganography with plaintext payloads. If you use only ciphertext payloads (with the keys exchanged out of band) you sidestep this problem.

Not really. Encrypting the message will yield uniformly distributed noise and that is a very rare in nature. So if you attempt to hide an encrypted message in the least significant bits of images, audio recordings or video it is as easy to detect as plain text messages if not even easier.

Re: DissidentX – Censorship resistance tool by Bram Cohen

#85

Post by chongli »

danbruc wrote: post #84
chongli wrote: post #29

Earlier quoted context omitted.

This is just showing steganography with plaintext payloads. If you use only ciphertext payloads (with the keys exchanged out of band) you sidestep this problem.

Not really. Encrypting the message will yield uniformly distributed noise and that is a very rare in nature. So if you attempt to hide an encrypted message in the least significant bits of images, audio recordings or video it is as easy to detect as plain text messages if not even easier.

Then don't use every LSB in the image; use a low percentage. Just a guess, but I bet if you applied your stego detection algorithm to a large sampling of random images on the internet, you'd find a significant false positive rate. Just hide your messages in the false positives.

Re: DissidentX – Censorship resistance tool by Bram Cohen

#86

Post by [deleted] »

anon4 wrote: post #67
sillysaurus2 wrote: post #62

Earlier quoted context omitted.

Here's one way it might go down in practice. After law enforcement seizes your computer, they'll scan your computer for any encrypted containers, along with any code that looks like it's used for steganography. They'll find DissidentX, since its README mentions "steganography," which is a keyword that their forensics tools will search for. Then they'll use each encoder in your DissidentX folder to scan your computer…

So can't you just embed messages in every file you own? Then when asked for the keys, give out fake keys for the really really secret stuff. So law enforcement ends up with a few sensitive documents and a whole bunch of random bytes where you cannot distinguish between "actual random bytes" and "bytes decoded with the wrong key". And there is your plausible deniability. Obviously it's not perfect. Obviously a totalit…

[deleted]

Re: DissidentX – Censorship resistance tool by Bram Cohen

#87

Post by radikalus »

It's been a long time since I've done work in infosec related things, so I apologize if I'm way behind on...things.

I remember in school a million years ago we discussed an algorithm of the following type for sending short covert messages.

1. Negotiate cipher/mapping for where to look for hidden information 2. A wants to send B message "Let's get drinks @ 9 @ Bill's" -- instead of inserting this into some random file, he instead maps to the cipher/mapping area and then iteratively searches for images/texts that are closest possible matches in those bits to his message. 3. Ideally, given access to enough cover files and a short enough message, he has an EXACT match. A sends B picture of puppies with NO bit twiddling. B knows to meet at the pub.

Re: DissidentX – Censorship resistance tool by Bram Cohen

#88

Post by eliteraspberrie »

sillysaurus2 wrote: post #59
infinity0 wrote: post #55

Earlier quoted context omitted.

From the README: Q. Can someone detect that a file has messages encoded in it? A. That depends on the encoding used and the properties of the file the data is being encoded in. There's a whole field of academic literature on steganography, none of which is invalidated by this code. What this code does is vastly simplify the implementation of new steganographic techniques, and allow a universal decoder and encoding of…

The README should read: Q. Can someone detect that a file has messages encoded in it? A. If the file was generated with an encoder whose code is public (i.e. Github, bitbucket, ...) then yes. Always. And even if the code is private, it may not be secure. Unless you come up with an encoding scheme that's never been thought of before, then law enforcement will likely be able to detect the encoded messages unless they'r…

I have been working on a new steganography algorithm that I believe is secure. I plan to make it open source in the new year. Would you like to review the design and code when it is released?

Re: DissidentX – Censorship resistance tool by Bram Cohen

#89

Post by eliteraspberrie »

Steganography has a bad reputation because the only tools publicly available are worthless. Not one is both secure according to Kerckhoffs's principle and secure against statistical analysis. I hope to change that by releasing an implementation of a new algorithm I have developed, sometime in the new year. If you are interested in reviewing the algorithm and code when it is released, feel free to follow my blog.

Re: DissidentX – Censorship resistance tool by Bram Cohen

#90

Post by Zuider »

wrongc0ntinent wrote: post #68
yid wrote: post #48

Earlier quoted context omitted.

That is actually remarkably clever. Spam would indeed seem to be an excellent vector for sending hidden messages!

What in this makes it get past spam filters?

It doesn't have to get past spam filters. Normally spam is held in the spam bin for 30 days.
Post reply on HN